CVE-2026-78633

Awaiting Analysis Awaiting Analysis - Queue

Okta RADIUS Agent Infinite Loop in Vendor-Specific Attribute Parsing

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Okta

Description

The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-78633

EUVD

EUVD-2026-100485

Affected Vendors & Products

Vendor	Product	Version / Range
Okta	Okta	RADIUS Agent 2.17.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

The Okta RADIUS Agent has a flaw where it fails to check the length of a sub-attribute in a Vendor-Specific attribute. If this sub-attribute has a length of zero, the parser enters an infinite loop, consuming worker threads and preventing new RADIUS authentication requests from being processed.

Impact Analysis

This vulnerability can lead to denial of service for RADIUS authentication requests. Users may be unable to authenticate through the Okta RADIUS Agent, disrupting access to protected systems and services.

Mitigation Strategies

Update the Okta RADIUS Agent to the latest version provided by Okta to address the parsing issue in Vendor-Specific attributes.

Hi! I’m here to help you understand CVE-2026-78633. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70